build: Django 5.2.17 LTS

Django 4.2 reached end of life on 2026-04-07.

- Django==5.2.17; django-login-required-middleware 0.9.0 keeps working
  (the authorization matrix passes).
- USE_L10N removed from the settings template.
- Log out is a POST form in the navbar; Django 5 removed GET logout.
- pip-audit in CI no longer ignores the Django 4.2.30 advisories.
- README: Django 5.2, backup step and upgrade notes for existing
  settings and GET logout callers.

python -Wd manage.py test shows no Django deprecation warnings. The live
libvirt suite passes on 5.2 and on 4.2 against a RHEL qemu-kvm host.

.github/workflows/test.yml

@@ -68,19 +68,8 @@ jobs:
       - name: Deployment Checks
         run: python manage.py check --deploy --fail-level ERROR
 
-      # The ignored IDs are Django 4.2.30 advisories, fixed in Django 5.2.17.
-      # Remove them with the Django 5.2 upgrade.
       - name: Audit Installed Packages
-        run: |
-          pip-audit \
-            --ignore-vuln PYSEC-2026-198 \
-            --ignore-vuln PYSEC-2026-199 \
-            --ignore-vuln PYSEC-2026-201 \
-            --ignore-vuln PYSEC-2026-2090 \
-            --ignore-vuln PYSEC-2026-2091 \
-            --ignore-vuln PYSEC-2026-2092 \
-            --ignore-vuln PYSEC-2026-3717 \
-            --ignore-vuln PYSEC-2026-4035
+        run: pip-audit
 
   docker:
     name: Docker Image

README.md

@@ -1,7 +1,7 @@
 [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/retspen/webvirtcloud)
 
 # WebVirtCloud
-###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.13)
+###### Python >=3.10 & Django 5.2 LTS (tested on Python 3.10 – 3.13)
 
 ## Purpose and Scope
 
@@ -394,6 +394,10 @@ environment=CSRF_TRUSTED_ORIGINS="https://webvirtcloud.example.com"
 
 ## How To Update
 
+Back up `db.sqlite3` before updating (in Docker it lives in the `data` volume).
+
+Upgrading from Django 4.2: delete `USE_L10N` from `webvirtcloud/settings.py` (Django 5 ignores it). Logging out now needs a POST; links or scripts that call `/accounts/logout/` with GET get 405.
+
 Before running migrations, add `accounts.middleware.ForcePasswordChangeMiddleware`
 to `MIDDLEWARE` in your existing `webvirtcloud/settings.py`, after
 `django.contrib.auth.middleware.AuthenticationMiddleware` (and the OTP/login-required

accounts/tests.py

@@ -76,7 +76,7 @@ class AccountsTestCase(TestCase):
         )
         self.assertRedirects(response, settings.LOGIN_REDIRECT_URL)
 
-        response = client.get(reverse("accounts:logout"))
+        response = client.post(reverse("accounts:logout"))
         self.assertRedirects(response, reverse("accounts:login"))
 
     def test_change_password(self):

conf/requirements.txt

@@ -1,4 +1,4 @@
-Django==4.2.30
+Django==5.2.17
 django_bootstrap5==26.2
 django-bootstrap-icons==0.9.0
 django-login-required-middleware==0.9.0

templates/navbar.html

@@ -44,7 +44,10 @@
             </a>
             <a class="dropdown-item {% view_active request 'accounts:profile' %}" href="{% url 'accounts:profile' %}">{% bs_icon 'person-vcard' %} {% trans "Profile" %}</a>
             <div class="dropdown-divider"></div>
-            <a class="dropdown-item" href="{% url 'accounts:logout' %}">{% bs_icon 'power' %}  {% trans "Log Out" %}</a>
+            <form method="post" action="{% url 'accounts:logout' %}">
+              {% csrf_token %}
+              <button type="submit" class="dropdown-item">{% bs_icon 'power' %}  {% trans "Log Out" %}</button>
+            </form>
           </div>
         </li>
       </ul>

webvirtcloud/settings.py.template

@@ -141,7 +141,6 @@ TIME_ZONE = "UTC"
 
 USE_I18N = True
 
-USE_L10N = True
 
 USE_TZ = True